search

mozilla / galaxy-api

INACTIVE - http://mzl.la/ghe-archive - To infinity and beyond. The backend API.
http://docs.galaxy.apiary.io/
BSD 3-Clause "New" or "Revised" License
9 stars 11 forks source link

Do request signing #241

Closed cvan closed 2 years ago

cvan commented 10 years ago

Potentially using JWTs. Keep in mind that galaxy.js (the client-side script) will be sending messages to and receiving messages from the API.

rfk commented 10 years ago

Noting possible synergy with https://github.com/mozilla/fxa-oauth-server/issues/140 so it would be good to pick/develop a consistent scheme.

cvan commented 10 years ago

Have you/y'all used hawk? I found this.

cvan commented 10 years ago

Have you/y'all used hawk? I found this.

Ah, I just read the issue more closely. Yes. Synergy. Heh, OAuth is hard.

rfk commented 10 years ago

Yeah, hawk has given us a surprising amount of trouble in practice, mostly due to timestamps ad clock skew. I still quite like it personally but we spent a lot of time fiddling with the details when using it for FxA+sync.

ckarlof commented 10 years ago

You could do request signing, but being able to use curl is nice. I'd recommend OAuth bearer tokens to start.

FYI, https://github.com/mozilla/fxa-oauth-server/issues/140 is for very privileged operations from dev and op machines.